Controlling access to content on an object addressable storage system

• US 8,146,155 B1
• Filed: 09/29/2007
• Issued: 03/27/2012
• Est. Priority Date: 09/29/2007
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: EMC Corporation (Dell Technologies Inc.)
• Inventors: Hushon, Jr., John D., Todd, Stephen J.
• Primary Examiner(s): Arani, Taghi
• Assistant Examiner(s): Rahman, Mahfuzur
• Application Number:
  US11/864,943
• Time in Patent Office: 1,641 Days
• Field of Search: 726/21
• US Class Current: 726/21
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

Embodiments of the invention relate to controlling access to a content unit stored on an object addressable storage (OAS) system. In one embodiment, the content unit may have an object identifier that is used to identify it on the OAS system. A first portion of a content unit may be assigned a first set of access permissions and a second portion of the content unit may be assigned a second set of access permissions that is different from the first set of access permissions.

Claims

1. A method of accessing a content unit stored on an object addressable storage (OAS) system, the content unit having a first portion and a second portion and being identified via an object identifier that is, from the perspective of a user accessing the content unit on the OAS system, independent of a storage location of the content unit on the OAS system, the method comprising acts, performed by at least one hardware processor, of:

assigning a first set of access permissions to the first portion of the content unit, wherein the first set of access permissions specifies a first set of users permitted to access the first portion of the content unit, wherein the act of assigning a first set of access permission to the first portion of the content unit further comprises acts of;

storing metadata on the OAS system that defines the first portion of the content unit; and

storing metadata on the OAS system that defines the first set of access permissions for the first portion of the content unit; and

assigning a second set of access permissions to the second portion of the content unit, wherein the second set of access permissions is different from the first set of access permissions, and wherein the second set of access permissions specifies a second set of users permitted to access the second portion of the content unit,

wherein the OAS system is a content addressable storage (CAS) system, and wherein the object identifier that identifies the content unit is a content address that is generated, at least in part, from at least a portion of the content of the content unit.

2. The method of claim 1, wherein the act of storing metadata on the OAS system that defines a portion of the content unit further comprises an act of:

storing metadata that identifies bytes in the content unit that comprise the first portion of the content unit.

3. The method of claim 1, wherein the act of storing metadata on the OAS system that defines a portion of the content unit further comprises an act of:

storing metadata that defines an identifier for the first portion of the content unit.

4. The method of claim 1, wherein the first set of users comprises at least one user selected from the group consisting of:

a person;

an application program; and

a host computer.

5. At least one non-transitory computer readable medium, encoded with instructions that, when executed, perform a method of accessing a content unit stored on an object addressable storage (OAS) system, the content unit having a first portion and a second portion and being identified via an object identifier that is, from the perspective of a user accessing the content unit on the OAS system, independent of a storage location of the content unit on the OAS system, the method comprising acts of:

assigning a first set of access permissions to the first portion of the content unit, wherein the first set of access permissions specifies a first set of users permitted to access the first portion of the content unit, wherein the act of assigning a first set of access permission to the first portion of the content unit further comprises acts of;

storing metadata on the OAS system that defines the first portion of the content unit; and

storing metadata on the OAS system that defines the first set of access permissions for the first portion of the content unit; and

assigning a second set of access permissions to the second portion of the content unit, wherein the second set of access permissions is different from the first set of access permissions, and wherein the second set of access permissions specifies a second set of users permitted to access the second portion of the content unit,

wherein the OAS system is a content addressable storage (CAS) system, and wherein the object identifier that identifies the content unit is a content address that is generated, at least in part, from at least a portion of the content of the content unit.

6. The at least one non-transitory computer readable medium of claim 5, wherein the act of storing metadata on the OAS system that defines a portion of the content unit further comprises an act of:

storing metadata that identifies bytes in the content unit that comprise the first portion of the content unit.

7. The at least one non-transitory computer readable medium of claim 5, wherein the act of storing metadata on the OAS system that defines a portion of the content unit further comprises an act of:

storing metadata that defines an identifier for the first portion of the content unit.

8. The at least one non-transitory computer readable medium of claim 5, wherein the first set of users comprises at least one user selected from the group consisting of:

a person;

an application program; and

a host computer.

9. An object addressable storage (OAS) system that stores a content unit having a first portion and a second portion and being identified via an object identifier that is, from the perspective of a user accessing the content unit on the OAS system, independent of a storage location of the content unit on the OAS system, the OAS system comprising:

an interface that receives an indication of a first set of access permissions for the first portions of the content unit and a second set of access permissions, different from the first set of access permissions, for the second content unit, wherein the first set of access permissions specifies a first set of users permitted to access the first portion of the content unit and wherein the second set of access permissions specifies a second set of users permitted to access the second portion of the content unit; and

at least one controller, comprising at least one processor and coupled to the interface, that;

assigns the first set of access permissions to the first portion of the content unit;

assigns a second set of access permissions to the second portion of the content unit;

stores metadata that defines the first portion of the content unit; and

stores metadata that defines the first set of access permissions for the first portion of the content unit,

wherein the OAS system is a content addressable storage (CAS) system, and wherein the object identifier that identifies the content unit is a content address that is generated, at least in part, from at least a portion of the content of the content unit.

10. The OAS system of claim 9, wherein the at least one controller:

stores metadata that identifies bytes in the content unit that comprise the first portion of the content unit.

11. The system of claim 9, wherein the at least one controller:

stores metadata that defines an identifier for the first portion of the content unit.